event id 10154 - effects?

hi,

on new server 2008 r2 dcs, see event id 10154:

winrm
service failed create following spns: wsman/testserver.testdomain.xyz;
wsman/dchostname.

additional data
error received 8344: %%8344.

the fix here  : https://social.technet.microsoft.com/forums/windowsserver/en-us/ff42d97f-8c52-4ddc-93a2-6ae79498e3d5/the-winrm-service-failed-to-create-the-following-spns , here http://www.ceyhunkirmizitas.net/microsoft/windows-server/event-id10154-the-winrm-service-failed-to-create-the-following-spns-wsman/

i know appears warning rather error know affected result of  network service account not having “validated write service principal name”  permissions? not fixing permissions per fixes result in ad operations being affected? pops on every 2008r2 dc.

thanks much,

ha

wsman/fqdn spn winrm (windows remote managament). spn needed if want authenticate service using kerberos authentication. if account used update ad spn doe not have required privileges so, no spn created/updated, kerberos won't work service.

if kerberos not work, windows fall ntlm, proabably work fine, less secure. you should fix this.

i think root if issue "network service" account. computers will update spn's in ad. in case of  dc's might not remote, network service needs explicit privileges (as network service impersonates domain\computer$ remote connections only).

updating ad 'network service' can update computer account object spns (as described in articles) valid solution. if don't it, can publish spns yourelf using setspn.

ps: not change adminsdholder, change computer account objects only.

---

mcp/mcsa/mcts/mcitp

Windows Server  >  Directory Services